DPA case 1809/452/18 – Complaint Upheld (Finland, 2020)

An applicant contacted the Finnish DPA, expressing data protection concerns over the housing cooperative's electric lock system and its implementation. According to the applicant, the residents were not informed about the details of the lock system. The electric lock system in question is installed at the entrance doors of the apartment building. According to the housing cooperative (controller), they do not receive any information from the lock, and the lock company that manages the system only allows access to the data at the request of the police. The housing cooperative therefore had made an assessment that the use of the electric lock system did not involve processing of personal data. The door opening data is personal data. Data does not need to be directly linked to the data subject in order to qualify as personal data. Individuals that use the electric keys can be identified in instances where the key identification information is matched with a specific apartment. Especially those residents that are living alone, they can in practice be identified with a high degree of certainty. The processing of personal data always requires a legal basis for processing, and compliance with the other data protection provisions. As the controller had assessed that no personal data was being processed, it had not defined the legal basis for processing the data, nor in any other way ensured the timely fulfillment of the obligations to the controller under the GDRP. The processing of the personal data has therefore been unlawful. As per Article 58(2) d, the Finnish DPA ordered the housing cooperative to bring the personal data processing activities in line with GDPR. The decision is not final.